Lucene search

K

Veracode Vulnerability DatabaseVERACODE:6069

HistoryApr 10, 2018 - 5:18 a.m.

Remote Code Execution (RCE)

2018-04-1005:18:40

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

13

0.793 High

EPSS

Percentile

98.3%

spring-messaging is susceptible to remote code execution (RCE) attack. The vulnerability exists due to incomplete fix of CVE-2018-1270 for 4.3.x branch.

CPENameOperatorVersion
spring messagingle5.0.4.RELEASE
spring messagingle4.3.15.RELEASE
spring-boot-starter-amqple2.0.0.RELEASE
spring-boot-starter-websocketle2.0.0.RELEASE
spring messagingle5.0.4.RELEASE
spring messagingle4.3.15.RELEASE
spring-boot-starter-amqple2.0.0.RELEASE
spring-boot-starter-websocketle2.0.0.RELEASE

References

www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

www.securityfocus.com/bid/103771

www.securitytracker.com/id/1041301

access.redhat.com/errata/RHSA-2018:1320

access.redhat.com/errata/RHSA-2018:2939

github.com/spring-projects/spring-framework/commit/0009806debb578e884f6dc98bd1f2dc668020021

lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe@%3Cissues.activemq.apache.org%3E

lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c@%3Cissues.activemq.apache.org%3E

lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3Cissues.activemq.apache.org%3E

pivotal.io/security/cve-2018-1275

spring.io/blog/2018/04/09/cve-2018-1275-address-partial-fix-for-cve-2018-1270

www.oracle.com/security-alerts/cpujul2020.html

www.oracle.com/security-alerts/cpuoct2021.html

www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

www.sourceclear.com/vulnerability-database/security/remote-code-execution-rce-/java/sid-6054/summary

0.793 High

EPSS

Percentile

98.3%